I also want this, but only to run my own apps which I build for my private use. If you don't assume the user is incompetent, you could build a secure browser that provides permission prompts to opt out of cors.